github-release-management

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads outsider-authored free text from GitHub PRs/commit messages at runtime (e.g., PR titles/bodies and commit messages used to generate changelogs via gh pr list ... --json ... and gh api ... compare ... --jq '.commits[].commit.message'), which are then ingested by the LLM to produce release notes.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes npx claude-flow (e.g., in CI and local commands) which fetches and executes remote package code from the npm registry (https://registry.npmjs.org) at runtime, so the registry URL is a runtime external dependency that can execute remote code.